From 2013 to 2022: What the ISO 27001 Transition Means for Your Business?
What does the ISO 27001 move from 2013 to 2022 mean for your business now?
The transition period ended on 31 October 2025, so ISO 27001:2013 certificates are no longer valid. If you transitioned in time, keep your ISMS aligned with the 2022 edition and its 2024 amendment. If you did not, you need a new certification audit against ISO/IEC 27001:2022.
If you transitioned
Your certificate covers the 2022 edition. Keep your Statement of Applicability, new controls and surveillance audits current.
If you missed it
Your 2013 certificate is no longer valid. Plan an initial certification audit against the 2022 edition.
What changed
93 controls in four themes, 11 new controls and a 2024 climate action amendment.
ISO/IEC 27001:2022 was published on 25 October 2022 and replaced the 2013 edition. Certification bodies had until 31 October 2025 to move their clients across, and certificates that were not transitioned are no longer valid.
This guide explains what changed, what it means whether or not you transitioned, and the steps to take now. If you need help, see our ISO 27001:2022 certification and implementation services.
Last updated: October 2026
ISO 27001:2022 Transition Timeline
The International Accreditation Forum set a three-year transition period, which ended on 31 October 2025. The table shows the milestones that mattered.
| Date | Milestone |
|---|---|
| 25 October 2022 | ISO/IEC 27001:2022 is published and replaces the 2013 edition. |
| 31 October 2023 | Accreditation bodies had to complete the transition of certification bodies to the 2022 edition. |
| 1 May 2024 | New certifications and recertifications had to be against the 2022 edition. |
| 31 October 2025 | Final deadline. Certificates still on the 2013 edition ceased to be valid. |
| After 31 October 2025 | Organisations without a transitioned certificate need an initial certification audit against the 2022 edition. |
We found no extension to the final date in published guidance. If your situation is unusual, such as a certificate suspended during the transition, ask your certification body what applies to you.
What Changed in ISO 27001:2022
Most of the change sits in Annex A. The main clauses were updated more lightly and aligned with the common structure used across ISO management system standards, which makes the standard easier to combine with others such as ISO 22301 and ISO/IEC 27701.
2013 edition
114 Annex A controls in 14 domains.
2022 edition
93 Annex A controls in four themes: organisational, people, physical and technological. Some controls were merged or renamed, and 11 were added.
The 11 New Controls
Amendment 1:2024
ISO later published Amendment 1:2024, which added climate action changes to the 2022 edition. Organisations now need to consider whether climate change is a relevant issue when they define the context of their ISMS, and record that decision.
What the Transition Means for You Now
Your next steps depend on whether your certificate was moved to the 2022 edition before the deadline. Check the edition and date printed on your certificate, then find your situation below.
If you transitioned
- Confirm the certificate names ISO/IEC 27001:2022 and the scope you expect.
- Keep the Statement of Applicability current, with evidence for the 11 new controls or a reason for any exclusion.
- Check that your context records consider climate change, as Amendment 1:2024 requires.
- Keep internal audits and annual surveillance audits on schedule.
If you missed the deadline
- Stop relying on the 2013 certificate in your website, proposals and contracts, because it is no longer valid.
- Check which customer contracts require a valid certificate, and tell those customers your plan and timeline.
- Plan an initial certification audit against the 2022 edition, which is more extensive than a transition audit.
- Ask your certification body when it can schedule Stage 1 and Stage 2.
Not sure which applies? Ask your certification body to confirm the status of your certificate in writing.
Steps to Get Compliant with ISO 27001:2022
These five steps apply whether you are bringing a lapsed ISMS up to the 2022 edition or checking that a transitioned one is still aligned.
- Run a gap analysis against the 2022 clauses and the 93 Annex A controls, so you know what is missing before you spend on fixes.
- Update the risk assessment, treatment plan and Statement of Applicability, including the 11 new controls and the climate change consideration.
- Implement and evidence the controls, train staff on the changes, and keep records that show the controls operate. Technical controls such as vulnerability management are often evidenced through VAPT integrated into your ISMS.
- Complete an internal audit and a management review, using our guide on how to conduct an ISO 27001 internal audit before certification, and close the findings.
- Book the certification audit with an accredited certification body. A lapsed certificate needs the Stage 1 and Stage 2 audits, while a transitioned one continues with its surveillance schedule.
CyberSapiens supports steps one to four as a consultancy. The audit itself is carried out by an independent certification body, which we do not replace.
Explore ISO 27001:2022 ServicesContent Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
ISO 27001:2013 to 2022 Transition: Frequently Asked Questions
When was the deadline to move from ISO 27001:2013 to 2022?
The final deadline was 31 October 2025. Certificates still on the 2013 edition stopped being valid after that date.
Is my ISO 27001:2013 certificate still valid?
No, unless it was transitioned to the 2022 edition before the deadline. Ask your certification body to confirm the status of your certificate in writing.
Do I need a full audit if I missed the transition?
Yes. You need an initial certification audit against the 2022 edition, with Stage 1 and Stage 2, because the shorter transition audit is no longer available.
What are the biggest changes in ISO 27001:2022?
Annex A now has 93 controls in four themes, including 11 new ones such as threat intelligence, data leakage prevention and secure coding.
Can a small business manage the move without a consultant?
Yes, if you have the time to run a gap analysis and keep proper records. A consultant can save time, but the audit itself must be done by an independent certification body.
Need to Get Certified to ISO 27001:2022?
Talk to CyberSapiens about a gap analysis and a plan to certify against the 2022 edition. We will scope the work with you and explain what the certification body will expect.
Call us
1300 507 668Email us
[email protected]Visit us
Lvl 1, 206 Lorimer St, Port Melbourne, Australia
